Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Any Suggestions For Securing Users With Admin Rights?


  • Please log in to reply
8 replies to this topic

#1 jr788

jr788

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:35 PM

Posted 25 January 2008 - 04:42 PM

Hello All!

I've been on the bleepingcomputer site for some time but finally created an account :thumbsup:

Because of the nature of the software we use at work all workstation users have to be a member of the Administrator group to use it. As a result, the guys in the back have a nack for downloading bad stuff and removing the sunshine from my day :flowers:

Anyone have any suggestions on how I can limit what they can do (prevent malware, spyware, downloading of bs...ect) while they have the Admin rights?

The workstations are all custom built with Windows XP Pro SP2

There is the main Admin account and they log in with a user account thats part of the Admin group.

Edited by jr788, 25 January 2008 - 04:48 PM.


BC AdBot (Login to Remove)

 


m

#2 Monty007

Monty007

  • Members
  • 1,151 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:02:05 PM

Posted 26 January 2008 - 02:35 AM

Hi jr, so are they admins on there own PCs or admins on the Domain? What is the software that requires a admin account?
MCP
MSDST

#3 Teenage.Zombiee

Teenage.Zombiee

  • Members
  • 831 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Western Sydney, Australia.
  • Local time:03:35 PM

Posted 26 January 2008 - 03:03 AM

With some adminstrative programs you can control all users rights.
Search around.

Also, find out what domains they are downloading this malicious software from. Block access to the site for all users.
if it keeps happenign try and track down the sites. It might be a pain but if you can't find software that will help you control rights.

Just a thought :thumbsup:

Edited by Teenage.Zombiee, 26 January 2008 - 03:10 AM.

Teenage.Zombiee is back ! :halloween:


#4 VirtueOfPanda

VirtueOfPanda

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:04:35 AM

Posted 26 January 2008 - 12:52 PM

Hi jr788,

Use of a HOSTS file would help, I think... something like this one maybe? Also, what about SpywareBlaster. This prevents certain spyware from installing in the first place...

~VirtueOfPanda~
Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.

#5 jr788

jr788
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:35 PM

Posted 27 January 2008 - 09:35 PM

Thanks for the replies :flowers:

The workstations have Admin rights on the PC accounts but not the Domain.
The software is Snapon ShopKey 5 & Management (Service Writer)

ShopKey has user rights options, but that only works within the program & won't help with the things they get on the internet.

I have McAfee AV & SpywareBlaster on it (I just downloaded the MS Defender also). It appears this last infection came from someone downloading a key generator for either Windows of MS Office :thumbsup:

I enabled the content blocker in Internet Explorer, but it seems most pages don't have ratings so it blocks just about everything. I'm sure they go to porn sites (mechanics are dirty boys lol) and that's were a lot of hazards come from.

Someone has also installed LimeWire in lou of a radio, could this be a potential problem also?

#6 Teenage.Zombiee

Teenage.Zombiee

  • Members
  • 831 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Western Sydney, Australia.
  • Local time:03:35 PM

Posted 28 January 2008 - 05:39 AM

Someone has also installed LimeWire in lou of a radio, could this be a potential problem also?

It all depends on what they download. I would advise them to only download music on the MP3 or M4A format.

WMA files can be dangerous as they can cause popups and other malware issues. If you're interested on reading about the dangers of WMA files downloaded from P2P I suggest you read Risk Your PC's Health For A Song?

Also I would block them from downloading certain file extentions from LimeWire. I reccomend blocking WMA, EXE, ZIP, RAR, WMV or any other zipped file you know of. Get some info on how here

Teenage.Zombiee is back ! :halloween:


#7 jr788

jr788
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:35 PM

Posted 29 January 2008 - 12:27 AM

Thanks for all the help :thumbsup:

I'll be following the LimeWire tips.

What does anyone think about disabling the Windows Installer through Admin Policies (gpedit.msc). They have Admin rights and could change it back, but I seriously doubt anyone using the PC is savvy enough to figure out how. Then, when I need to do system updates I could just enable it and disable it again when I'm done. Or would this cause more problems than it's worth?

p.s. in case ne ones wondering about my edit, i'm having problems with my "e"s today, I typed system as systme, done as doen, and cause as cause, LOL, sorry, I'm a dork and find it funny :trumpet:

ppss. I give up, i can't even type my edit right :flowers:

Edited by jr788, 29 January 2008 - 12:31 AM.


#8 Teenage.Zombiee

Teenage.Zombiee

  • Members
  • 831 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Western Sydney, Australia.
  • Local time:03:35 PM

Posted 29 January 2008 - 12:51 AM

That would be up to you but some programs don't use Windows Installer to install. Which can be a problem because some malware I know of does not use MS installer.

I'd give the people who work with you a warning. More or less a threat: any more porn or malware and there will be no more admin rights. This would be a last resort of corse but why should your day be runined because of their stupid mistakes ehh? :thumbsup:

Teenage.Zombiee is back ! :halloween:


#9 ZGMFX24SCHAOS

ZGMFX24SCHAOS

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:35 PM

Posted 02 February 2008 - 01:29 AM

In cases like limiting users' actions, I would recommend "Security Administrator v11.5". It has a wide variety of choices to limit actions taken by a user like editing stuffs, downloading things, etc.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users